Appeals court raises standard for laptop searches at US border

Still, a sex offender with encrypted files was suspicious enough to search.

Citizens' rights to be free from searches don't hold everywhere. At border crossings, as in airports, people can be searched by authorities as a matter of routine course. But what should the standard be for not just rummaging through a briefcase, but for when the government wants to dig deep into the files on our electronic gadgets—even looking at deleted files?

A "watershed" decision from a federal appeals court today ruled that the government must have "reasonable suspicion" to do such an intensive computer search. However, the judges also ruled that standard was met in the search in question, which involved child pornography being brought across the border from Mexico. The US Court of Appeals for the 9th Circuit, sitting "en banc," reversed a lower court's decision to suppress an intensive forensic analysis of a laptop belonging to a traveler, Howard Cotterman, which resulted in a discovery of child pornography.

The search started out as a "cursory review at the border but transformed into a forensic examination of Cotterman's hard drive." The court acknowledged it was a "watershed case" with implications for what kind of privacy rights all Americans can expect with regards to password-protected files on their computers.

A criminal history and password-protected files create “reasonable suspicion”

Border searches are an exception to the general principle, protected by the Fourth Amendment, that warrants be obtained. Still, a border is not an "anything goes" zone, as an 8-3 majority of the court emphasized in today's decision [PDF]. Searches still need to be based on a "reasonable suspicion."

Cotterman was returning to the US with his wife from a vacation in Mexico in 2007. In a routine check, a border computer system returned a hit for Cotterman—he was a sex offender, and had been convicted on several counts, including child molestation, in 1992. The agents then searched his car, and found two laptops and three digital cameras, which they also inspected. Those devices had several password-protected files.

The border agents suspected, based in part on the existence of password-protected files, that Cotterman may have been engaged in sex tourism. They interviewed him and his wife, and ultimately released them—but kept the laptops and one camera. The laptop was brought to an Immigration and Customs Enforcement office in Tucson, Arizona, where an ICE agent performed intensive forensic search on the laptops. On one laptop, the search found 75 images of child pornography in the "unallocated space" of the hard drive, which is where deleted data resides.

Cotterman was indicted on child porn charges. The judge overseeing his case ruled the evidence should be suppressed. Cotterman's 15-year-old history, combined with the mere presence of password-protected files, wasn't enough to justify a search under the "reasonable suspicion" standard. That judge's decision was reversed by an appeals panel, and now the case has gone to the full 9th Circuit, with a majority agreeing that the government did have a right to search the laptop.

The majority in today's ruling found that "the legitimacy of the initial search... is not in doubt." That search would have been fine, even without "particularized suspicion," a majority of judges held. But the intensive forensic examination that analyzed the whole hard drive presents a "difficult question," they acknowledged. Even though the rules are different at the border, searches must still be regulated somehow.

Still, the majority felt that on balance, the search was justified.

In defining the new standard, the majority recognized that technology has created a situation where a search of electronics has become much more intrusive over time. Judge Margaret McKeown wrote:

The amount of private information carried by international travelers was traditionally circumscribed by the size of the traveler’s luggage or automobile. That is no longer the case. Electronic devices are capable of storing warehouses full of information. The average 400-gigabyte laptop hard drive can store over 200 million pages—the equivalent of five floors of a typical academic library.

... With the ubiquity of cloud computing, the government’s reach into private data becomes even more problematic. In the “cloud,” a user’s data, including the same kind of highly sensitive data one would have in “papers” at home, is held on remote servers rather than on the device itself.

And while certain privacy rights are given up during travel, others are not.

"International travelers certainly expect that their property will be searched at the border," wrote McKeown. "What they do not expect is that, absent some particularized suspicion, agents will mine every last piece of data on their devices or deprive them of their most personal property for days (or perhaps weeks or even months, depending on how long the search takes). Such a thorough and detailed search of the most intimate details of one’s life is a substantial intrusion upon personal privacy and dignity."

Still, reasonable suspicion was found here, with the main factors being the fact that Cotterman had a history of sex offenses, and had password-protected files. "Although password protection of files, in isolation, will not give rise to reasonable suspicion, where, as here, there are other indicia of criminal activity," it becomes an important factor, wrote McKeown.

Dissents in multiple directions

Today's decision includes two dissents, arguing in different directions. One dissent, signed onto by three judges, argues that the decision actually makes it too hard for border agents to conduct searches. Those three argue that the government should be given wide clearance to perform searches at the border, and that the advent of new technology doesn't change that.

The government's job of stopping "drugs, bombs, or child pornography" from entering the country is a "Herculean task" and "requires that the government be mostly free from the Fourth Amendment's usual restraints on searches of people and their property," writes Judge Consuelo Callahan, a George W. Bush appointee. "The majority relies primarily on the notion that electronic devices are special to conclude that reasonable suspicion was required," Callahan continues. "The majority is mistaken."

She notes that the Supreme Court has only once required "reasonable suspicion" in the 125 years it has been reviewing border-search cases. "[C]ourtesy of the majority’s decision, criminals now know they can hide their child pornography or terrorist connections in the recesses of their electronic devices," she writes.

There's dissent even among the dissenters in this opinion. A second dissent, written by Judge Milan Smith, agrees that the majority was wrong to establish a "reasonable suspicion" requirement for searches at the border. But Smith goes on to argue there was also no reasonable suspicion to do the more intensive "extended border search" of Cotterman's computer at the Tucson facility, 170 miles away from the border.

"I fail to see how the agents had reasonable suspicion that Cotterman’s computer contained 'illegal files' based solely on his 15-year-old sex offense, travel to Mexico with his wife, and the 'ubiquitous' act of password-protection," wrote Smith. "Mexico is a popular travel destination for Californians, including those who travel to Mexico for its beaches, culture and weather, and not for its sex tourism."

"Under the doctrine of this case, the majority sweeps in thousands of innocent individuals whose electronic equipment can now be taken away from the border and searched indefinitely, under the border search exception," writes Smith.

Number Six: Where am I?Number Two: In the Village.Number Six: What do you want?Number Two: Information.Number Six: Whose side are you on?Number Two: That would be telling. We want information… information… in formation.Number Six: You won't get it.Number Two: By hook or by crook, we will.Number Six: Who are you? Number Two: The new Number Two.Number Six: Who is Number One?Number Two: You are Number Six.Number Six: I am not a number! I am a free man!Number Two: [laughs]

I was optimistic when reading the title of the post, but upon reading the article it seems the standard was raised from "you need no reason at all" to "you need to come up with some reason, any reason and just document it." That hardly seems like a standard at all.

I was optimistic when reading the title of the post, but upon reading the article it seems the standard was raised from "you need no reason at all" to "you need to come up with some reason, any reason and just document it." That hardly seems like a standard at all.

Reasonable suspicion has been a standard in other contexts for decades. It doesn't mean *a lot,* but it's far from no suspicion at all. This guy is a sex offender with child molesting convictions; he's bringing back three digital cameras and two laptops; and the laptops have encrypted files.

Do you have a reason for suspecting that he might have CP on his laptop? Of course - you don't have probable cause, but these are real reasons.

(I should point out, although it's noted in the article, that the 4th amendment traditionally didn't apply to border crossings at all - you can be stopped and searched for no reason at all if you are crossing a border; you can also be detained and questioned for no real reason. So this is far more protection than what currently exists, even though I *kind of* think that the 4th amendment doesn't really apply at all.)

So because of a charge 15 years prior, for which he had completed serving his sentence, they had reasonable cause? There are so many things wrong with this. Guess the government has deeply integrated the belief "once a criminal, always a criminal."

I guess what is concerning is so someone goes to Mexico then on they way back they are stopped and are searched and oh their laptop had is encrypted. Say they had a prior drug conviction. So now it's ok to say well you have an encrypted hd and a prior so we can take your stuff and search you even though you might encrypt your hd to prevent it being hacked if stolen to protect your ssn or credit card info from the Internet purchases you may have made. Maybe perhaps you encrypt it b/c you can.....so the mere fact that you choose to protect the privacy of your personal info can be used against you...aka you have incriminated yourself by encrypting your hd....wtf

I guess when crossing the borders of any country, you use the same advice given to business travelers to China. Use a laptop who's sole purpose is to VPN into your real computer. Don't save the VPN password. Wipe everything everyday.

(I pretty much do this already. My travel netbook ran Fedora and pretty much only had VPN+VNC on it. I left it at the SFO airport my last trip to the US ... oh well, $200 gone, no big deal.)

So is the permission to search limited to things you have physically with you while crossing the border, or does it now extend to whatever you have in the cloud accessible from your laptop? If I carry my house key across the border, does that imply that my house can be searched without warrant?

One single word in the article troubles me the most:"equipment can now be taken away from the border and searched indefinitely"

Everyone may be searched at borders for no reason. That initial search may yield some "suspicion", whether it's your criminal past, the criminal past of your associates, the fact that your laptop or phone has encrypted files, or maybe a drug-sniffing dog barked in the general vicinity of your luggage. So they're now legally allowed to hold your device indefinitely.

So in essence people with priors can not do something that other people whom have not been convicted of a crime can do without suspicion. (Ok child porn is associated with files but maybe He was convicted of domestic abuse...so lets search his emails to see if he threaded anyone else...maybe he has emails about wanting to kill his ex...) Just by the fact that encryption could possibly maybe kind of sort of hid evidence of a crime does not justify that it means that he has. So wait he was convicted and presumably did time or some how paid the price for his crime and now that is used against him...nice..so much for paying your debt to society...looks like the debt is forever. The ends never justify the means. Is he a dirt bag for having it...sure. But eroding our rights to justify his conviction.....no way. Ou in all this

P.s. wife.....where were you in all this...really you married this guy and he still has child porn around....again wtf

Small blades were the entire reason that 9/11 was able to happen. Now, the security theater decided that it wasn't such a gross violation to begin with.

So you're certain the fact that in 2001 the following: a) Cockpit security on American flights was lax. b) The accepted way to deal with hijackers was to placate them.had no contribution to the success of the terrorists during the 9-11 events? The box cutters were the "entire reason", eh?

However now in 2013, or any time after 2002: a) Cockpits are reinforced and access is severely restricted b) Hijackers are attacked immediately by any able bodied person on the plane.

Today, if one brought Excalibur on a plane and attempted to use it hijack a plane, there'd be NO CHANCE that that person could bring down the plane. Maybe he/she might kill a few people, but he/she would definitely be rushed and subdued by the passengers/airline staff/air marshals.

So today, there is no chance that a swiss army knife, or a box cutter, is of any danger to the whole plane... at most a few people within arm's reach.

I disagree with almost everything about this, aside from the vague "well, they can't actually just search whatever they want", which is pretty damned weak.

My belief is that the most they should be able to do, absent a warrant, is test externals. Dogs, those little explosive-detecting wipes, etc absent a warrant or specific evidence.

If they get a warrant to search an individual, OK. At least it went through the courts and the person was, specifically, determined to be a suspect in drugrunning or whatever. It may be wrong, but at least there was someone else involved other than some random border patrol officer. If you think a person is going to relapse on getting their child porn fix, then surely you could issue a standing warrant, or make it a component of their parole (if the guy was on parole, dunno).

If they see someone being handed a white packet, which is then stuffed in their bag, OK. It'll be embarassing if it's a pair of underwear, but drugs are often white and often come in packets. Similarly, if the sniffing dog goes bonkers, or the little wipes do whatever it is they do, there's god specific reason to search.

But in this case? They didn't have any reason to suspect he was carrying child porn other than he had a previous. They were right in their assumption, but IMO wrong in their reasoning and actions.

So I am planning to place several encrypted files on my electronic devices from now on. Inside each file will be a word document and 1 picture of me showing them the finger. I think I will encrypt the picture in another file just to make it look even more suspicious.

Then I will await the police when they come to arrest me for making fun of them.

Sorry but if your into porn or a terrorist there are many ways of "smuggling" data in.FedEx yourself a hard drive or a flash drive.

Just not the best and brightest officers working customs, sorry Saul (friend and Border Patrol agent) but you know it is true.

Seriously? I don't fly that often, but did they finally realize that a swiss army knife is about as dangerous as bare hands?

Small blades were the entire reason that 9/11 was able to happen. Now, the security theater decided that it wasn't such a gross violation to begin with.

No, complacent passengers who would sit there and wait for hostage negotiators after their hijacked plane got taken to Cuba were the entire reason that 9/11 was able to happen. Anyone who tries to hijack a plane now is going to be beaten to death by all the other passengers. As soon as they reinforced the cockpit doors and learned the lesson of Flight 93, we've been safe in the air from anyone onboard the plane (except pilots, I suppose). We should have turned our entire focus onto explosives and external threats (dudes with shoulder-fired missiles on the ground), rather than worry about attacks the terrorists will not try again. The TSA has been reacting to FAILED attacks like the attempted shoe bomber, and worrying about nail clippers, and it's all been a huge waste of time and money.

What happened on 9/11 was that ordinary people realized they need to take responsibility for their own safety, and fight back. Why isn't the government promoting this idea, when it's been shown time and time again that it's the MOST effective way of stopping terrorist attacks in progress? Shoe bomber was defeated by flight attendants and passengers. Underwear bomber was defeated by passengers. Leaving planes for a bit, Times Square bomber was defeated by a couple of street vendors.

If you want to stop terrorism, you stop being afraid and you act when you find yourself in a scary situation. You don't sit there and wait to get slaughtered or run away from places that might be dangerous. The first line of defense to terrorism is the intelligence work that tries to disrupt plots before they reach fruition. Ordinary people reacting appropriately to defend themselves, taking responsibility for their own safety, will catch almost everything else. The TSA doesn't catch anything, because anyone who gets a plan together without getting caught by intelligence work will plan to get past the TSA.

I'm all for bomb-sniffing dogs at our airports. Knives don't bother me one bit. Heck, bring a machete on board for all I care. Maybe you can kill one or two people before the entire population of that plane charges you and overwhelms you, so what? I can get stabbed while I'm walking down the street. It's not called terrorism when a guy gets stabbed with a knife.

One single word in the article troubles me the most:"equipment can now be taken away from the border and searched indefinitely"

Everyone may be searched at borders for no reason. That initial search may yield some "suspicion", whether it's your criminal past, the criminal past of your associates, the fact that your laptop or phone has encrypted files, or maybe a drug-sniffing dog barked in the general vicinity of your luggage. So they're now legally allowed to hold your device indefinitely.

It's not unreasonable to put a time-limit on seized property.

I'm sure the governments position will be they can keep it until copyright on the files on the HD expire [so 70 years after you die, your heirs will get a package in the mail, COD].

And don't forget, this amendment free zone is NOT just for people crossing the border, but if you happen to be with 100 miles of the border, regardless of whether you have or intend to cross the border. I wonder if they include people's houses that are within this constitution-free zone?

If a child pornographer were to ask me how to protect himself, and if I were stupid enough to tell him here is what I would say. Write a program which creates a temporary directory on each separate partition of your hard drive. Fill each temporary directory with files composed soley of 0 of size 100Mb. When each partition is full repeat with files of size 10MB. Then 1Mb, then 10k. Then 1k.

Delete all the temporary directories.

Redo but write "FF"'s to the file..

Repeat this process seven times.

Doing this you've cleaned your hard drives of the remnants of deleted files to military standards.

It only takes an hour or so to do. The whole process can be automated and put on a boot disk.

This is something someone of sufficient technical background can do.

A person who has taken a single course in programming can do it.

So we are now creating classes of people. The technical and those who are technical but are capable of using a computer. We allow those are technical enough to avoid some searches, but allow others who are capable of using a computer but not technical enough to clean their computers subject to more thorough searches.

Remember that a decision by the Ninth Circuit Court of Appeals just means that this decision applies in the states covered by the Ninth Circuit, unless it goes to the Supreme Court and is affirmed. So this isn't national precedent yet.

Remember that a decision by the Ninth Circuit Court of Appeals just means that this decision applies in the states covered by the Ninth Circuit, unless it goes to the Supreme Court and is affirmed. So this isn't national precedent yet.

That is not quite correct.Prosecutors in other districts can cite the precident and unless a judge has some precident which contradicts the finding from some other district they will generally go along with it.

It can be cited, but a judge in another circuit doesn't have to follow it. A judge can rule otherwise if he wants to. A lawyer in another circuit can likewise cite a foreign case in an effort to make an argument, but such rulings (foreign or from another U.S. circuit) don't compel the judge to obey. He can rule another way and if the appeals court for that circuit agrees with him, the two circuits will have DIFFERENT precedents until the Supreme Court ends up having some reason to set national precedent.

1. Geography matters in federal practice.The basics of federal stare decisis are easily understood. Decisions of the U.S. Supreme Court bind all other federal courts, decisions of the various circuit courts of appeals bind the federal district courts located within each circuit, and the decisions of district courts generally have no binding precedential effect. Thus, a district court judge in California is not bound to follow precedent from any circuit court except published decisions from the Ninth Circuit Court of Appeals, which has appellate jurisdiction over California’s federal courts. In other words, geography—specifically whether a given district court sits within a given circuit—has substantive meaning in federal practice.

Guess the government has deeply integrated the belief "once a criminal, always a criminal."

Oddly enough, generally true with the chesters of the world.

This isn't about statistical likelihood of committing a crime (the number of ways an idea like that could be abused are unimaginable). It's about a judicial system that recognizes the moral standing that once a sentence is filled the perpetrator's debt to society is complete.

Oh well. I thought for once there would be no mention of TERRORISM as one of the justifications for laptop searches on the border but towards the end of the article Judge Callahan came through in fine fashion. < sigh >

Disappointed they found a 15-year-old conviction and some encrypted files was justification to seize his computers and dig through everything on them. Electronic devices have to be treated specially because they can access unlimited information about us. Email saved locally, pictures, browser cache, correspondence - a laptop can easily hold several years of your life on it. Include Facebook, email, and various online accounts that log in automatically and even a smartphone can access your entire life!

We can't let the boogeymen of child pornography and terrorism enable infinite invasion of our privacy. They don't report all the cases where they took someone's computer and found nothing criminal.

I guess when crossing the borders of any country, you use the same advice given to business travelers to China. Use a laptop who's sole purpose is to VPN into your real computer. Don't save the VPN password. Wipe everything everyday.

I fully agree with this. The thing that bothers me is I think the court got it right in establishing some protection while still giving good guidance as to what constitutes reasonable suspicion, BUT giving how I feel we live in a surveillance society, I am still very bothered by this example of the powers of governments to breach our privacy. So I agree with your solution. I just wish we had a magic wand that would stop criminals from using the same things that should be automatic protections for the rest of us.

This is one of those decisions that ends with a dirtbag off the street but also erodes our freedoms even more. Kinda sucks.

The government loves using dirtbags to erode our freedoms*, because it cuts down on opposition.

This is the one and only reason why it's important to defend a child-raping pig like this guy.**

*Technically, the government loves using dirtbags to adjust the law to make their job easier. The net effect is the same.

**The Ars story glosses over how spectacularly horrible the evidence against this guy they found is. The 75 images of child porn was the tip of the iceberg. I read the judge's decision which summarized the rest of the evidence uncovered when the investigator got through the password protected files, including a sickening number of images of this guy raping a child. It also states that he said he would decrypt the files for them but when the time to do that came, he no-showed, fled the country, and flew to Australia. All of that aside, for all our sakes, he needs to be found innocent (or convicted without this evidence). And then he needs to bump into Jack Ruby in the courthouse parking lot.